From e77a1d86e83369894e2b80c1ab2b32bad8df52ed Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Tue, 4 Aug 2026 13:34:39 -0700 Subject: [PATCH 1/3] Add Compliance removal step to Enterprise upgrade docs The Compliance resource owns the compliance workloads and RBAC, so deleting it before upgrade lets Kubernetes garbage collect them. --- .../kubernetes-upgrade-tsee/helm.mdx | 12 ++++++++++++ .../kubernetes-upgrade-tsee/operator.mdx | 12 ++++++++++++ .../upgrading-enterprise/openshift-upgrade.mdx | 12 ++++++++++++ 3 files changed, 36 insertions(+) diff --git a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index 4380f070bb..aad9f7d4a9 100644 --- a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -38,6 +38,18 @@ the upgrade. If your cluster has Windows nodes and uses custom TLS certificates for log storage then, prior to upgrade, prepare and apply new certificates for [log storage](../../../../operations/comms/index.mdx) that include the required service DNS names. +### Compliance + +The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. + +```bash +kubectl delete compliance tigera-secure +``` + +If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. + +If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. diff --git a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx index 788acedd08..936609fa08 100644 --- a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx +++ b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx @@ -45,6 +45,18 @@ have their reclaim policy set to [retain data](https://kubernetes.io/docs/tasks/ Retaining data is only recommended for users that use a valid Elastic license. Trial licenses can get invalidated during the upgrade. +### Compliance + +The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. + +```bash +kubectl delete compliance tigera-secure +``` + +If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. + +If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. diff --git a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx index cb08b2d7a2..d2d99d3f36 100644 --- a/calico-enterprise/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx +++ b/calico-enterprise/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx @@ -48,6 +48,18 @@ have their reclaim policy set to [retain data](https://kubernetes.io/docs/tasks/ Data retention is recommended only for users that have a valid Elasticsearch license. (Trial licenses can be invalidated during upgrade). +### Compliance + +The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. + +```bash +oc delete compliance tigera-secure +``` + +If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. + +If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. From 5cbfd219159079ee4d661a493e13d4455098a6c8 Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Tue, 4 Aug 2026 13:47:50 -0700 Subject: [PATCH 2/3] Add the Compliance removal step to the 3.24-1 upgrade docs --- .../kubernetes-upgrade-tsee/helm.mdx | 12 ++++++++++++ .../kubernetes-upgrade-tsee/operator.mdx | 12 ++++++++++++ .../upgrading-enterprise/openshift-upgrade.mdx | 12 ++++++++++++ 3 files changed, 36 insertions(+) diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index 4380f070bb..aad9f7d4a9 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -38,6 +38,18 @@ the upgrade. If your cluster has Windows nodes and uses custom TLS certificates for log storage then, prior to upgrade, prepare and apply new certificates for [log storage](../../../../operations/comms/index.mdx) that include the required service DNS names. +### Compliance + +The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. + +```bash +kubectl delete compliance tigera-secure +``` + +If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. + +If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx index 18bc07b4fe..5b7370b8a9 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx @@ -45,6 +45,18 @@ have their reclaim policy set to [retain data](https://kubernetes.io/docs/tasks/ Retaining data is only recommended for users that use a valid Elastic license. Trial licenses can get invalidated during the upgrade. +### Compliance + +The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. + +```bash +kubectl delete compliance tigera-secure +``` + +If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. + +If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx index 6fdaa140a6..6565db9e6f 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx @@ -48,6 +48,18 @@ have their reclaim policy set to [retain data](https://kubernetes.io/docs/tasks/ Data retention is recommended only for users that have a valid Elasticsearch license. (Trial licenses can be invalidated during upgrade). +### Compliance + +The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. + +```bash +oc delete compliance tigera-secure +``` + +If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. + +If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. + ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. From 890d1bc4f2fc4c2b9f89be248ac213f142964f9f Mon Sep 17 00:00:00 2001 From: Casey Davenport Date: Tue, 4 Aug 2026 17:48:49 -0700 Subject: [PATCH 3/3] Revert "Add the Compliance removal step to the 3.24-1 upgrade docs" This reverts commit 5cbfd219159079ee4d661a493e13d4455098a6c8. --- .../kubernetes-upgrade-tsee/helm.mdx | 12 ------------ .../kubernetes-upgrade-tsee/operator.mdx | 12 ------------ .../upgrading-enterprise/openshift-upgrade.mdx | 12 ------------ 3 files changed, 36 deletions(-) diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx index aad9f7d4a9..4380f070bb 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/helm.mdx @@ -38,18 +38,6 @@ the upgrade. If your cluster has Windows nodes and uses custom TLS certificates for log storage then, prior to upgrade, prepare and apply new certificates for [log storage](../../../../operations/comms/index.mdx) that include the required service DNS names. -### Compliance - -The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. - -```bash -kubectl delete compliance tigera-secure -``` - -If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. - -If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. - ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx index 5b7370b8a9..18bc07b4fe 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/kubernetes-upgrade-tsee/operator.mdx @@ -45,18 +45,6 @@ have their reclaim policy set to [retain data](https://kubernetes.io/docs/tasks/ Retaining data is only recommended for users that use a valid Elastic license. Trial licenses can get invalidated during the upgrade. -### Compliance - -The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. - -```bash -kubectl delete compliance tigera-secure -``` - -If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. - -If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. - ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section. diff --git a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx index 6565db9e6f..6fdaa140a6 100644 --- a/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx +++ b/calico-enterprise_versioned_docs/version-3.24-1/getting-started/upgrading/upgrading-enterprise/openshift-upgrade.mdx @@ -48,18 +48,6 @@ have their reclaim policy set to [retain data](https://kubernetes.io/docs/tasks/ Data retention is recommended only for users that have a valid Elasticsearch license. (Trial licenses can be invalidated during upgrade). -### Compliance - -The Compliance feature is removed in this release. Delete the Compliance resource before you upgrade, so that Kubernetes garbage collects the compliance deployments, service accounts, and RBAC that it owns. - -```bash -oc delete compliance tigera-secure -``` - -If you manage $[prodname] resources with GitOps tooling, remove the Compliance resource from your source manifests as well. Otherwise the tooling recreates it after you upgrade. - -If you receive an error indicating the resource or resource type does not exist, Compliance was not installed in your cluster. You can safely ignore the error and proceed. - ### Upgrade OwnerReferences If you do not use OwnerReferences on resources in the projectcalico.org/v3 API group, you can skip this section.